CVE-2026-2248 - Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

Back Back to CVE browser

CRITICAL

Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

Published Feb 11, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.55%

Description

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

Affected products

Vendor METIS Cyberspace Technology SA Product Metis Wic Default
unaffected
- Version
  oscore 2.1.234-r18
  Status
  affected
  Constraints
  -
- Version
  oscore 2.1.235-r19
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

METIS Cyberspace Technology SA

Metis Wic

unaffected

Version	Status	Constraints
oscore 2.1.234-r18	affected	-
oscore 2.1.235-r19	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-306

Missing Authentication

References (2)

https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic
technical-description
https://www.metis.tech/
x_vendor-website

Link	Providers	Tags
https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic		technical-description
https://www.metis.tech/		x_vendor-website